Application developers must protect sensitive content on devices where access to an embedded, pluggable or external hardware secure element is not feasible. Developers have limited options to ensure the protection of their sensitive content. Typical methods either rely on the native platform protection mechanisms, such as an application sandbox for separating running programs, combined with optional encryption under a global disk encryption key or derive an encryption key from a weak user personal identification number (PIN) or password.
For example, in a Mobile Device Management (MDM) and Mobile Application Management (MAM) system, an application container on a mobile device is managed remotely by the MDM/MAM server to protect the mobile application data both at rest and in transit. The data encryption keys are typically stored on the device using weak passwords. Another example is a Password Vault or Password Manager application that stores encrypted user passwords on the device, which typically uses a master password scheme. In such cases, should a single device application get compromised by an attacker, the underlying encryption or data protection key gets leaked, and the data contents of the device are exposed to the attacker.
A need therefore exists for new techniques for protecting the encryption key(s) on devices, such as mobile devices. A further need exists for new techniques for protecting content encryption keys against a direct application compromise by an attacker.